Use the options in Trellix DLP Capture Settings to enable the capture feature and set how long you want to retain capture data for.
Note
The Trellix DLP Capture Settings menu option doesn't appear in ePO - On-prem until you add a license for one of the Trellix DLP Network Monitor appliances.
Go to Menu → Policy Catalog.
From the Product drop-down list, select DLP Appliance Management <version> → Trellix DLP Capture Settings.
Select My Default.
Select Enable Capture to enable capture settings.
To avoid running out of disk space, select Delete captured items older than (days) and enter the number of days to retain the captured data for.
By default, the captured data is retained for 28 days.
Data Loss Prevention (DLP) > Trellix Data Loss Prevention 11.14.x Product Guide > The DLP Capture Search feature > Searching captured data > Working with the DLP Capture feature
Data Loss Prevention (DLP) > Trellix Data Loss Prevention 11.12.x Product Guide - June 2025 > The DLP Capture Search feature > Searching captured data > Working with the DLP Capture feature
Data Loss Prevention (DLP) > Trellix Data Loss Prevention 11.12.x Product Guide - June 2025 > Appendix > Policy Catalog settings > DLP Appliance Management
Data Loss Prevention (DLP) > Data Loss Prevention On-prem > Monitor > Trellix Data Loss Prevention Network Monitor 11.11.x Installation Guide - December 2025 > Trellix DLP implementation > Optional deployment scenarios